FedRAMP decides whether a cloud service may hold federal information at all, so the first question is scope, and the agency answers it, not the provider. Once in scope, the impact level sets the class, the calendar sets the path (Rev 5 closes to new applicants in June 2027; 20x is the automation-based route), and the same NIST SP 800-53 control set you build for it is reused by GovRAMP, TX-RAMP and the DoD equivalency that CMMC contractors need from their suppliers. The pages below start with the scope test and follow the work from there.
1 pages on FedRAMP, in the order the work happens. Jump to the stage you are at, or read straight through.
Decide whether your service is in scope, which class it needs, which path to start on and what to budget.
These sit under another subject but bear directly on FedRAMP.
The free compliance check runs the FedRAMP gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users